The Agent Skills Directory

REMOTE_CODE_EXECUTION (HIGH): The run.js file implements a 'Universal Executor' pattern. It accepts raw JavaScript code from command-line arguments, file paths, or stdin, writes this code to a temporary file (e.g., .temp-execution-123.js), and then executes it using Node.js require(). This allows for the execution of any arbitrary Node.js code, which can perform sensitive file system or network operations.
COMMAND_EXECUTION (MEDIUM): The skill frequently uses child_process.execSync to perform environment setup and bundling.
In run.js, it executes npm install and npx playwright install automatically if dependencies are missing.
In the included .temp-execution-1770342857274.js file, it executes npx esbuild to bundle code.
DATA_EXPOSURE (LOW): The file .temp-execution-1770342857274.js appears to be a leftover from the author's development environment and contains hardcoded absolute paths (/mnt/Store/Projects/Mine/Github/...), exposing the author's local directory structure.
DYNAMIC_EXECUTION (MEDIUM): The run.js script dynamically wraps and modifies code strings at runtime before execution, including a reference to a non-existent helper library (./lib/helpers), which could lead to unpredictable behavior or errors during execution.

playwright-skill